feat(analytics): replace GA with PostHog EU#166
Merged
Conversation
|
Warning Review limit reached
Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
WalkthroughThe change replaces Google Analytics with PostHog EU product analytics, adds environment validation and CSP support, introduces typed and scrubbed event tracking, and instruments session, map, and premium flows. ChangesPostHog configuration and privacy contracts
Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/config/env.ts`:
- Around line 23-38: Update the PostHog host validation refine in
src/config/env.ts to normalize the URL and accept only the exact HTTPS origins
https://eu.i.posthog.com and https://eu-assets.i.posthog.com, matching
public/_headers; remove the prefix/suffix predicate. In src/config/env.test.ts,
extend the invalid-host cases to cover EU-prefixed non-allowlisted hosts such as
eu-preview.i.posthog.com and the HTTP origin http://eu.i.posthog.com.
In `@src/routes/Premium.tsx`:
- Around line 66-70: Update the checkoutState success handling in the Premium
component so analytics does not emit premium_purchase_completed based solely on
the client-controlled redirect query. Emit the purchase-completed event only
after refreshEntitlementsWithError confirms the server-side entitlement or
purchase state; otherwise track a distinct redirect-return event instead.
In `@src/services/core/analytics.test.ts`:
- Around line 69-75: Extend the scrubAnalyticsProperties coverage with a
nested-array case such as metadata containing [[{ sessionCode: "ABCD" }]],
expecting sessionCode to be removed. Update scrubAnalyticsProperties so array
elements are recursively scrubbed regardless of nesting depth, while preserving
existing filtering for non-array objects and scalar values.
In `@src/services/core/analytics.ts`:
- Around line 59-65: Update the array handling in scrubAnalyticsProperties so
nested arrays are recursively passed through the same scrubbing logic at every
depth, while preserving primitive values and object scrubbing. Ensure nested
structures such as arrays containing arrays of location objects cannot bypass
the location-data scrubber, and add a test covering this nested-array case.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c9b244fd-1f23-487d-9d19-fcd457ee5705
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (16)
.changeset/analytics-posthog.mdpackage.jsonpublic/_headerssrc/config/env.test.tssrc/config/env.tssrc/domain/legal/privacyPolicyContent.tssrc/routes/JoinSession.tsxsrc/routes/Premium.tsxsrc/routes/create-session/useCreateSession.tssrc/routes/map-screen/useMapScreenController.tssrc/services/billing/premiumBilling.tssrc/services/core/analytics.test.tssrc/services/core/analytics.tssrc/services/core/analyticsEvents.tssrc/services/session/sessionLifecycle.tsworker-configuration.d.ts
Comment on lines
+23
to
+38
| .url() | ||
| .refine( | ||
| (value) => { | ||
| try { | ||
| const host = new URL(value).hostname; | ||
| return ( | ||
| host === "eu.i.posthog.com" || | ||
| host === "eu-assets.i.posthog.com" || | ||
| (host.endsWith(".i.posthog.com") && host.startsWith("eu")) | ||
| ); | ||
| } catch { | ||
| return false; | ||
| } | ||
| }, | ||
| { message: "VITE_POSTHOG_HOST must be a PostHog EU origin" }, | ||
| ), |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Align accepted PostHog hosts with the CSP allowlist.
https://eu-preview.i.posthog.com passes this predicate, but public/_headers permits only https://eu.i.posthog.com and https://eu-assets.i.posthog.com. Configuration therefore succeeds while browser CSP blocks analytics capture. Validate a normalized exact HTTPS origin, and add rejection cases for EU-prefixed non-allowlisted hosts and HTTP.
src/config/env.ts#L23-L38: replace the prefix/suffix check with an exact origin allowlist matchingpublic/_headers.src/config/env.test.ts#L66-L73: add invalideu*.i.posthog.comandhttp://eu.i.posthog.comcases.
As per path instructions, **/*.test.{ts,tsx} requires “Edge cases for new logic.”
📍 Affects 2 files
src/config/env.ts#L23-L38(this comment)src/config/env.test.ts#L66-L73
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/config/env.ts` around lines 23 - 38, Update the PostHog host validation
refine in src/config/env.ts to normalize the URL and accept only the exact HTTPS
origins https://eu.i.posthog.com and https://eu-assets.i.posthog.com, matching
public/_headers; remove the prefix/suffix predicate. In src/config/env.test.ts,
extend the invalid-host cases to cover EU-prefixed non-allowlisted hosts such as
eu-preview.i.posthog.com and the HTTP origin http://eu.i.posthog.com.
Source: Path instructions
Comment on lines
66
to
70
| useEffect(() => { | ||
| /* eslint-disable react-hooks/set-state-in-effect -- refresh entitlements after Stripe redirect */ | ||
| if (checkoutState === "success") { | ||
| track(ANALYTICS_EVENTS.premium_purchase_completed, {}); | ||
| void refreshEntitlementsWithError(); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Do not report a completed purchase from the redirect query alone.
checkout=success is client-controlled and the event fires before entitlement refresh can confirm anything. This can inflate completed-purchase metrics for forged, stale, or failed checkout returns. Emit this only after server-confirmed purchase/entitlement state, or rename it to a redirect-return event.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/routes/Premium.tsx` around lines 66 - 70, Update the checkoutState
success handling in the Premium component so analytics does not emit
premium_purchase_completed based solely on the client-controlled redirect query.
Emit the purchase-completed event only after refreshEntitlementsWithError
confirms the server-side entitlement or purchase state; otherwise track a
distinct redirect-return event instead.
Source: Path instructions
Comment on lines
+69
to
+75
| it("scrubs forbidden keys inside arrays", () => { | ||
| expect( | ||
| scrubAnalyticsProperties({ | ||
| metadata: [{ sessionCode: "ABCD", tool: "pin" }], | ||
| }), | ||
| ).toEqual({ metadata: [{ tool: "pin" }] }); | ||
| }); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Scrub forbidden properties at every array depth.
metadata: [[{ sessionCode: "ABCD" }]] currently retains sessionCode: the implementation only recurses through immediate non-array object elements. Add this edge-case test and make the scrubber recursively process nested arrays before capture.
As per path instructions, **/*.test.{ts,tsx} requires “Edge cases for new logic.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/services/core/analytics.test.ts` around lines 69 - 75, Extend the
scrubAnalyticsProperties coverage with a nested-array case such as metadata
containing [[{ sessionCode: "ABCD" }]], expecting sessionCode to be removed.
Update scrubAnalyticsProperties so array elements are recursively scrubbed
regardless of nesting depth, while preserving existing filtering for non-array
objects and scalar values.
Source: Path instructions
Comment on lines
+59
to
+65
| if (Array.isArray(value)) { | ||
| scrubbed[key] = value.map((item) => { | ||
| if (item && typeof item === "object" && !Array.isArray(item)) { | ||
| return scrubAnalyticsProperties(item as Record<string, unknown>) ?? {}; | ||
| } | ||
| return item; | ||
| }); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Recursively scrub nested arrays.
[[{ coordinates: [...] }]] is returned unchanged because an inner array is neither recursed into nor treated as an object. This bypasses the location-data scrubber and can leak forbidden properties. Recurse through array values at every depth and add a nested-array test.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/services/core/analytics.ts` around lines 59 - 65, Update the array
handling in scrubAnalyticsProperties so nested arrays are recursively passed
through the same scrubbing logic at every depth, while preserving primitive
values and object scrubbing. Ensure nested structures such as arrays containing
arrays of location objects cannot bypass the location-data scrubber, and add a
test covering this nested-array case.
3 tasks
gelbh
added a commit
that referenced
this pull request
Jul 25, 2026
* chore(deps): add posthog-js * feat(analytics): replace GA with PostHog facade * feat(analytics): PostHog env CSP and privacy copy * feat(analytics): wire session and premium events * chore: add changeset for PostHog analytics * fix(analytics): ship thermos remediation for event layering * fix(analytics): address coderabbit cli review for scrub and host * fix(analytics): disable PostHog GeoIP and external features * fix(test): use vi.stubEnv for PostHog prod init coverage
gelbh
added a commit
that referenced
this pull request
Jul 25, 2026
* chore(deps): add posthog-js * feat(analytics): replace GA with PostHog facade * feat(analytics): PostHog env CSP and privacy copy * feat(analytics): wire session and premium events * chore: add changeset for PostHog analytics * fix(analytics): ship thermos remediation for event layering * fix(analytics): address coderabbit cli review for scrub and host * fix(analytics): disable PostHog GeoIP and external features * fix(test): use vi.stubEnv for PostHog prod init coverage
gelbh
added a commit
that referenced
this pull request
Jul 25, 2026
…h 2 updates (#150) * fix(ci): update settings map tab visual baseline (#74) * test(e2e): update settings map tab snapshot for tilt control * chore(ship): add npm run ship:poll wrapper script * fix(sentry): ignore IDB deleted errors (#75) * fix(sentry): ignore IDB deleted errors Fixes JETLAG-1S * fix(sentry): bind IDB reset to failed connection * fix(sentry): guard recaptcha and view transitions (#76) * fix(sentry): guard recaptcha and transitions Fixes JETLAG-1P JETLAG-1T * test(services): cover app check and IDB error helpers * fix: address coderabbit review for sentry error helpers * revert(map): remove tilted view preference (#77) * revert(map): remove tilted view preference * fix: address coderabbit review for map tilt revert * fix(admin): resolve CSP violations and redirect-first sign-in (#78) * fix(worker): route all requests through worker for nonce CSP * fix(csp): allow CF challenge scripts and drop insights beacon * fix(auth): use redirect-first Google sign-in under strict CSP * chore(changeset): admin CSP and sign-in fixes * fix(auth): remove unused test import * fix(auth): ship thermos remediation for redirect-first OAuth * fix(auth): address coderabbit review for OAuth tests and changelog * feat(photo): add external send fallback when upload is down (#79) * feat(photo): add sent_externally answer kind * feat(chat): replace photo upload with external send fallback * test(photo): cover mark-sent flow in unit, rules, and e2e * chore(changeset): photo external send fallback * fix(photo): disable mark-sent buttons while answer saves * fix(photo): address coderabbit review for errors and legacy preview * fix(admin): live-refresh map annotations in monitor (#80) * fix(admin): gate session sync on auth and clear annotations on switch * test(session): unmount hooks between useSessionSync emulator cases * fix(session): address CodeRabbit on admin annotation sync * chore(release): 0.6.3 (#81) * feat(game): game over, stats, friends & leaderboards (#82) * docs(game): add game-over stats leaderboard design spec * feat(game): game over stats, friends, and leaderboards * test(session): cover resetSessionForRematch callable client * test(firestore): cover game result and profile serialization * test(firestore): cover game result subscription client * test(firestore): cover trail and location writes for coverage gate * test(e2e): update smoke specs for Play hub home IA * fix: address coderabbit review for game over stats PR * fix: harden game-over subscription and trail sync edge cases * fix: simplify auth-loading splash on stats routes * chore(release): version 0.7.0 (#83) * chore(release): version 0.7.0 * test(emulator): retry storage rules emulator cleanup * test(e2e): fix home safe-area spec for Play hub IA (#84) * fix(map): harden elimination worker and radar submit errors (#85) * fix(map): harden elimination worker and radar submit errors * fix: address coderabbit review for radar hardening * feat(map): policy-driven question-setting placement camera (#86) * feat(map): add policy-driven question-setting placement camera * fix: address coderabbit review for placement camera * fix: address remaining coderabbit review for placement camera * chore(release): version 0.7.1 (#87) * fix(auth): restore popup-first Google sign-in on premium (#88) * fix(auth): restore popup-first Google sign-in on premium * fix(auth): address coderabbit review for premium sign-in * chore(release): version 0.7.2 (#89) * feat(auth): unique username claim and social gates (#90) * feat(auth): claim unique username after sign-in * test(auth): align claimUsername tests with handler errors * fix(auth): ship thermos remediation for username identity * fix(auth): allow profile hook reset without lint error * fix(auth): tidy profile hook lint disables * fix(auth): address coderabbit review for username claim * fix(auth): require claimed username for profile identity * feat(friends): username search and friend requests (#91) * feat(friends): search usernames and manage friend requests * fix(friends): resolve mutual requests without orphan pending docs * fix(friends): satisfy lint for list load and error cause * fix(friends): rate-limit actions, cap pending lists, expand tests * test(friends): cover profileFriends client callable wrapper * fix(friends): loosen profileFriends test mock typing * feat(leaderboard): ranked list with board subscribe (#92) * feat(leaderboard): ranked list UI with board subscribe * fix(leaderboard): lint subscribe effect and harden entry parse * fix(leaderboard): tidy set-state-in-effect lint disable * test(leaderboard): cover entry parse and board subscribe * fix(leaderboard): drop unused onSnapshot error param in test * fix(leaderboard): contiguous ranks after invalid entry filter * fix(leaderboard): respect reduced motion on rank skeleton * fix(navigation): wrap route navigate in startViewTransition for WebKit (#93) * fix(navigation): wrap route navigate in startViewTransition for WebKit * fix(navigation): address coderabbit route transition findings * feat(map): smoother hybrid camera motion for question placement (#94) * feat(map): smoother hybrid camera motion for question placement * test(map): add computeFramedCenterZoom regression test * test(map): add computeFramedCenterZoom padding and clamp cases * refactor(map): extract isLargeCameraJump into domain layer * fix(map): reset focusPreferFly after one-shot reframe is consumed * chore(release): version 0.8.0 (#95) * fix(sentry): filter IDB closing and Safari Load failed (#96) * fix(sentry): filter IDB closing and Safari Load failed Fixes JETLAG-1X Fixes JETLAG-1V * fix(sentry): ship thermos remediation for client noise filters * test(sentry): cover Load failed trim in client noise predicate * fix(map): harden map export against html2canvas oklch (#97) * fix(map): harden map export against oklch html2canvas parse Fixes JETLAG-8 * fix(map): ship thermos remediation for map export oklch handling * fix(map): rewrite clone colors to rgb before html2canvas capture * fix(map): address coderabbit review for html2canvas color rewrite * chore(release): version 0.8.1 (#98) * chore(release): version 0.8.1 * docs(release): polish 0.8.1 notes for player-facing wording * fix(sentry): match Safari Load failed host suffixes (#99) * fix(sentry): match Safari Load failed host suffixes Fixes JETLAG-1Y * fix(sentry): tighten Load failed host-suffix matcher * test(e2e): add mobile layout and axe smoke checks (#101) * test(e2e): add mobile layout and axe smoke checks * fix(e2e): ship thermos remediation for layout axe smoke * fix(e2e): assert map more-tools control stays in viewport * ci: add stylelint for hand-written css (#100) * ci: add stylelint for hand-written css * fix(ci): ship thermos remediation for stylelint base * fix(ci): make pre-commit stylelint paths filename-safe * fix(ci): harden pre-commit path handling for bash * fix(ci): reject partial staging in pre-commit lint hooks * fix(ci): fail closed when inspecting unstaged pre-commit paths * test(e2e): harden visual smoke coverage for entry screens (#103) * ci: add lighthouse mobile budgets on pull requests (#102) * ci: add lighthouse mobile budgets on pull requests * fix(ci): ship thermos remediation for lighthouse config * fix(ci): use lighthouse target-size assertion id * fix(ci): disable checkout credentials for lighthouse job * fix(sync): ignore already-exists on trail point append (#104) * fix(sync): ignore already-exists on trail point append * fix(ci): re-exec pre-commit under bash for husky sh * feat(leaderboard): layout viewport quality gates (#105) * feat(leaderboard): scroll metric filters as chip strip * test(e2e): gate social layout overflow and visuals * ci: add nightly layout-deep playwright workflow * fix(e2e): ship thermos remediation for layout viewport gates * fix: address coderabbit review for layout viewport gates * fix(e2e): assert metric chip tap height not width * feat(changelog): nest closed versions under minor and major groups (#106) * feat(changelog): nest closed versions under minor and major groups * fix(changelog): avoid render-time reassignment for latest highlight * fix(changelog): sort entries and cover empty/invalid grouping edges * chore(release): version 0.8.2 (#107) * fix(admin): frame real play area on first monitor join (#108) * fix(admin): re-read session after join so map frames play area * fix(admin): extract join-preview helpers under 1k-line limit * fix(admin): use getDocFromServer after join membership write * test(admin): mock getDocFromServer on join re-read path * fix(admin): keep join-preview helpers leaflet-free for emulator * docs(changelog): clarify admin observe framing changeset copy * feat(thermometer): cancel orphan and stuck GPS walks (#109) * feat(thermometer): cancel orphan and stuck GPS walks * fix(thermometer): move identity-heal walk cancel out of annotations * fix(thermometer): avoid Date.now during MapTimerCluster render * fix(thermometer): satisfy react-compiler and unused walk id lint * fix(thermometer): address coderabbit cancel review * test(thermometer): type getDocs mock for identity-heal coverage * feat(leaderboard): board filters, lead pack, and sticky self footer (#110) * feat(leaderboard): board filters, lead pack, and sticky self footer * fix(leaderboard): fix board ready locator and stale self footer * fix(leaderboard): fix self-entry metric type and effect lint * fix(leaderboard): drop unused eslint-disable in self entry * fix(leaderboard): address coderabbit board chrome review * test(leaderboard): update filters visual snapshot for board chrome * test(leaderboard): update filters visual snapshot for board chrome * test(leaderboard): use 390x115 filters screenshot as baseline * feat(ui): desktop content column for entry screens (#111) * feat(ui): add desktop content column for entry screens * fix(ui): scope desktop entry CTA max-width to entry hosts * fix(ui): address coderabbit desktop entry review * fix(ui): restore Feedback desktop flex column parent * fix(ui): address coderabbit desktop entry spacing and tests * test(e2e): refresh tutorial sandbox visual baselines on main (#116) * feat(ui): desktop social column and friends master-detail (#112) * feat(ui): desktop social column and friends master-detail * fix(friends): allow selection clear effect for desktop master-detail * fix(leaderboard): constrain self footer to social column on desktop * feat(map): desktop ops shell with left tool rail (#113) * feat(map): desktop ops shell with left tool rail * fix(map): win rail dock CSS over fixed bottom dock * fix(map): restore walking-cancel props on desktop status rail * feat(map): desktop contextual rail + sheet host (#114) * feat(map): add contextual rail and sheet host for desktop ops * fix(map): gate rail Escape and tool shortcuts * fix(map): split rail panel hook for fast refresh and harden shortcuts * fix(map): drop unused ContextualRailTab import * docs(desktop): add desktop-ops-adapt changeset for wide-screen layout (#115) * chore(release): version 0.9.0 (#117) * chore(release): version 0.9.0 * chore(release): bump package-lock to 0.9.0 * perf(caching): edge Cache-Control + elevation/entitlements/join soft TTL (#118) * perf(worker): set cache-control for assets and geo * perf(geo): persist elevation samples in indexeddb * perf(billing): persist premium entitlements snapshot * perf(session): debounce and cache join code preview * fix(caching): harden entitlements uid check and elevation hydrate order * test(session): assert join preview cache expires at ttl boundary * perf(functions): shared Overpass L2 cache (KV + R2) (#119) * perf(functions): add shared overpass l2 cache via r2 and kv * fix(functions): wire overpass l2 secrets and sigv4 header order * fix(session): Background Sync honesty + Transitland 5m L1 (#120) * fix(session): honor background sync for offline annotations * fix(pwa): restore skip_waiting and sync retry without clients * chore(release): version 0.9.1 (#121) * fix(functions): make overpass l2 secrets optional for deploy (#122) * ci: modernize PR-gated suite and thin main CD (#123) * ci: modernize PR-gated suite and thin main CD * fix(ci): ship thermos remediation for paths-filter and deploy outputs * fix(ci): address coderabbit review for checkout and shell env * chore(ci): soften CodeRabbit App for CLI-primary gate (#143) * chore: purge .cursor/ path mentions from tracked files * chore: ignore agent-local IDE dir and harden pre-push * chore: drop agent-local dir from tracked gitignore * ci(dependabot): group updates and auto-merge safe npm bumps (#144) * ci(dependabot): group npm patch and minor by dependency type * ci(dependabot): auto-merge npm patch and minor when checks pass * docs: note Dependabot grouping and auto-merge policy * fix(ci): ship thermos remediation for Dependabot auto-merge deploy * fix: address coderabbit cli review for Dependabot config * fix: address coderabbit cli review for automerge head bind * chore(deps): bump the production-dependencies group Bumps the production-dependencies group in /functions with 2 updates: [@sentry/node](https://github.com/getsentry/sentry-javascript) and [firebase-functions](https://github.com/firebase/firebase-functions). Updates `@sentry/node` from 10.65.0 to 10.67.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.65.0...10.67.0) Updates `firebase-functions` from 7.2.5 to 7.3.0 - [Release notes](https://github.com/firebase/firebase-functions/releases) - [Commits](firebase/firebase-functions@v7.2.5...v7.3.0) --- updated-dependencies: - dependency-name: "@sentry/node" dependency-version: 10.67.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: firebase-functions dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * chore: purge IDE config path mentions from tracked files * chore: ignore local IDE dir and harden pre-push * chore: drop local IDE dir from tracked gitignore * ci(dependabot): group updates and auto-merge safe npm bumps (#144) * ci(dependabot): group npm patch and minor by dependency type * ci(dependabot): auto-merge npm patch and minor when checks pass * docs: note Dependabot grouping and auto-merge policy * fix(ci): ship thermos remediation for Dependabot auto-merge deploy * fix: address coderabbit cli review for Dependabot config * fix: address coderabbit cli review for automerge head bind * fix(overpass): normalize AbortError to timed-out 504 without Sentry (#155) * fix(overpass): normalize AbortError and retry HTTP 500 with failover logs * test(overpass): cover failover AbortError and retryable statuses * fix(overpass): ship thermos remediation for failover status classify * fix: address coderabbit cli review for overpass failover tests * fix: address coderabbit cli review for overpass body cancel * fix: address coderabbit cli review for async body cancel * fix(overpass): align QL timeout with 25s fetch abort (#157) * feat(admin): annotation filters and sorts on session list (#158) * feat(admin): add annotation count and last-annotation session filters * test(admin): add annotation fields to AdminPanel fixtures * fix(admin): coalesce session list refresh and fix initial loading (#160) * fix(session): canonical end + idle purge orphan code sweep (#159) * fix(session): end idle sessions with outcome and delete codes * fix(session): raise idle purge batch and sweep orphan codes * fix(session): finalize game results on abandoned outcome * fix(session): ship thermos remediation for canonical end race * fix(session): address coderabbit cli review for end/purge * fix(session): delete session codes inside end transaction * feat(session): host leave promote and endSession callables (#161) * feat(session): add leaveHostSession and endSession callables * feat(session): wire host leave promote and endSession callable * fix(session): end alone host leave inside promote transaction * fix(session): fall back to client end when callables unavailable * fix(session): reclaim orphan session codes on create (#162) * fix(session): reclaim orphan session codes on create * fix(session): allow orphan sessionCodes delete in rules * test(session): expect missing code after endRemoteSession delete * chore(release): 0.9.2 host leave transfer notes (#163) * feat(analytics): replace GA with PostHog EU (#166) * chore(deps): add posthog-js * feat(analytics): replace GA with PostHog facade * feat(analytics): PostHog env CSP and privacy copy * feat(analytics): wire session and premium events * chore: add changeset for PostHog analytics * fix(analytics): ship thermos remediation for event layering * fix(analytics): address coderabbit cli review for scrub and host * fix(analytics): disable PostHog GeoIP and external features * fix(test): use vi.stubEnv for PostHog prod init coverage * fix(map): restore iPhone PWA status bar safe-area inset (#169) * perf(a11y): public-shell floors and create weight (#167) * perf(firebase): lazy-init App Check on first token use * fix(a11y): allow pinch zoom in viewport meta * fix(a11y): raise contrast on action and dim tokens * fix(create): request geolocation only on user gesture * perf(create): defer map mount and preconnect basemaps * chore: add changeset for perf a11y shells * ci(lhci): raise public-shell score floors * fix(test): avoid parameter properties in App Check mock * fix(create): ship thermos remediation for map defer ownership * fix(firebase): arm App Check before Functions callables * fix(ci): address coderabbit cli review for lhci and App Check * fix(ci): mock App Check in functions lazy tests and ease LHCI floor * fix(ci): ease mobile LHCI floors after PostHog on main --------- * feat(analytics): PostHog consent banner (#168) * feat(analytics): add consent preference storage * feat(analytics): gate PostHog behind consent * feat(analytics): add production consent banner * chore: add changeset for analytics consent * fix(analytics): ship thermos remediation for consent capture gate * fix(analytics): seed e2e consent and capture pageview on accept * fix(analytics): seed consent denial in first-run e2e --------- * chore(release): 0.9.3 analytics, consent, and a11y notes (#170) * chore(ci): reject Cursor attribution trailers in commit-msg (#171) * chore(ci): harden commit-msg hook before commitlint --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Tomer Gelbhart <gelbharttomer@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
gelbh
added a commit
that referenced
this pull request
Jul 25, 2026
…ectory with 13 updates (#164) * fix(ci): update settings map tab visual baseline (#74) * test(e2e): update settings map tab snapshot for tilt control * chore(ship): add npm run ship:poll wrapper script * fix(sentry): ignore IDB deleted errors (#75) * fix(sentry): ignore IDB deleted errors Fixes JETLAG-1S * fix(sentry): bind IDB reset to failed connection * fix(sentry): guard recaptcha and view transitions (#76) * fix(sentry): guard recaptcha and transitions Fixes JETLAG-1P JETLAG-1T * test(services): cover app check and IDB error helpers * fix: address coderabbit review for sentry error helpers * revert(map): remove tilted view preference (#77) * revert(map): remove tilted view preference * fix: address coderabbit review for map tilt revert * fix(admin): resolve CSP violations and redirect-first sign-in (#78) * fix(worker): route all requests through worker for nonce CSP * fix(csp): allow CF challenge scripts and drop insights beacon * fix(auth): use redirect-first Google sign-in under strict CSP * chore(changeset): admin CSP and sign-in fixes * fix(auth): remove unused test import * fix(auth): ship thermos remediation for redirect-first OAuth * fix(auth): address coderabbit review for OAuth tests and changelog * feat(photo): add external send fallback when upload is down (#79) * feat(photo): add sent_externally answer kind * feat(chat): replace photo upload with external send fallback * test(photo): cover mark-sent flow in unit, rules, and e2e * chore(changeset): photo external send fallback * fix(photo): disable mark-sent buttons while answer saves * fix(photo): address coderabbit review for errors and legacy preview * fix(admin): live-refresh map annotations in monitor (#80) * fix(admin): gate session sync on auth and clear annotations on switch * test(session): unmount hooks between useSessionSync emulator cases * fix(session): address CodeRabbit on admin annotation sync * chore(release): 0.6.3 (#81) * feat(game): game over, stats, friends & leaderboards (#82) * docs(game): add game-over stats leaderboard design spec * feat(game): game over stats, friends, and leaderboards * test(session): cover resetSessionForRematch callable client * test(firestore): cover game result and profile serialization * test(firestore): cover game result subscription client * test(firestore): cover trail and location writes for coverage gate * test(e2e): update smoke specs for Play hub home IA * fix: address coderabbit review for game over stats PR * fix: harden game-over subscription and trail sync edge cases * fix: simplify auth-loading splash on stats routes * chore(release): version 0.7.0 (#83) * chore(release): version 0.7.0 * test(emulator): retry storage rules emulator cleanup * test(e2e): fix home safe-area spec for Play hub IA (#84) * fix(map): harden elimination worker and radar submit errors (#85) * fix(map): harden elimination worker and radar submit errors * fix: address coderabbit review for radar hardening * feat(map): policy-driven question-setting placement camera (#86) * feat(map): add policy-driven question-setting placement camera * fix: address coderabbit review for placement camera * fix: address remaining coderabbit review for placement camera * chore(release): version 0.7.1 (#87) * fix(auth): restore popup-first Google sign-in on premium (#88) * fix(auth): restore popup-first Google sign-in on premium * fix(auth): address coderabbit review for premium sign-in * chore(release): version 0.7.2 (#89) * feat(auth): unique username claim and social gates (#90) * feat(auth): claim unique username after sign-in * test(auth): align claimUsername tests with handler errors * fix(auth): ship thermos remediation for username identity * fix(auth): allow profile hook reset without lint error * fix(auth): tidy profile hook lint disables * fix(auth): address coderabbit review for username claim * fix(auth): require claimed username for profile identity * feat(friends): username search and friend requests (#91) * feat(friends): search usernames and manage friend requests * fix(friends): resolve mutual requests without orphan pending docs * fix(friends): satisfy lint for list load and error cause * fix(friends): rate-limit actions, cap pending lists, expand tests * test(friends): cover profileFriends client callable wrapper * fix(friends): loosen profileFriends test mock typing * feat(leaderboard): ranked list with board subscribe (#92) * feat(leaderboard): ranked list UI with board subscribe * fix(leaderboard): lint subscribe effect and harden entry parse * fix(leaderboard): tidy set-state-in-effect lint disable * test(leaderboard): cover entry parse and board subscribe * fix(leaderboard): drop unused onSnapshot error param in test * fix(leaderboard): contiguous ranks after invalid entry filter * fix(leaderboard): respect reduced motion on rank skeleton * fix(navigation): wrap route navigate in startViewTransition for WebKit (#93) * fix(navigation): wrap route navigate in startViewTransition for WebKit * fix(navigation): address coderabbit route transition findings * feat(map): smoother hybrid camera motion for question placement (#94) * feat(map): smoother hybrid camera motion for question placement * test(map): add computeFramedCenterZoom regression test * test(map): add computeFramedCenterZoom padding and clamp cases * refactor(map): extract isLargeCameraJump into domain layer * fix(map): reset focusPreferFly after one-shot reframe is consumed * chore(release): version 0.8.0 (#95) * fix(sentry): filter IDB closing and Safari Load failed (#96) * fix(sentry): filter IDB closing and Safari Load failed Fixes JETLAG-1X Fixes JETLAG-1V * fix(sentry): ship thermos remediation for client noise filters * test(sentry): cover Load failed trim in client noise predicate * fix(map): harden map export against html2canvas oklch (#97) * fix(map): harden map export against oklch html2canvas parse Fixes JETLAG-8 * fix(map): ship thermos remediation for map export oklch handling * fix(map): rewrite clone colors to rgb before html2canvas capture * fix(map): address coderabbit review for html2canvas color rewrite * chore(release): version 0.8.1 (#98) * chore(release): version 0.8.1 * docs(release): polish 0.8.1 notes for player-facing wording * fix(sentry): match Safari Load failed host suffixes (#99) * fix(sentry): match Safari Load failed host suffixes Fixes JETLAG-1Y * fix(sentry): tighten Load failed host-suffix matcher * test(e2e): add mobile layout and axe smoke checks (#101) * test(e2e): add mobile layout and axe smoke checks * fix(e2e): ship thermos remediation for layout axe smoke * fix(e2e): assert map more-tools control stays in viewport * ci: add stylelint for hand-written css (#100) * ci: add stylelint for hand-written css * fix(ci): ship thermos remediation for stylelint base * fix(ci): make pre-commit stylelint paths filename-safe * fix(ci): harden pre-commit path handling for bash * fix(ci): reject partial staging in pre-commit lint hooks * fix(ci): fail closed when inspecting unstaged pre-commit paths * test(e2e): harden visual smoke coverage for entry screens (#103) * ci: add lighthouse mobile budgets on pull requests (#102) * ci: add lighthouse mobile budgets on pull requests * fix(ci): ship thermos remediation for lighthouse config * fix(ci): use lighthouse target-size assertion id * fix(ci): disable checkout credentials for lighthouse job * fix(sync): ignore already-exists on trail point append (#104) * fix(sync): ignore already-exists on trail point append * fix(ci): re-exec pre-commit under bash for husky sh * feat(leaderboard): layout viewport quality gates (#105) * feat(leaderboard): scroll metric filters as chip strip * test(e2e): gate social layout overflow and visuals * ci: add nightly layout-deep playwright workflow * fix(e2e): ship thermos remediation for layout viewport gates * fix: address coderabbit review for layout viewport gates * fix(e2e): assert metric chip tap height not width * feat(changelog): nest closed versions under minor and major groups (#106) * feat(changelog): nest closed versions under minor and major groups * fix(changelog): avoid render-time reassignment for latest highlight * fix(changelog): sort entries and cover empty/invalid grouping edges * chore(release): version 0.8.2 (#107) * fix(admin): frame real play area on first monitor join (#108) * fix(admin): re-read session after join so map frames play area * fix(admin): extract join-preview helpers under 1k-line limit * fix(admin): use getDocFromServer after join membership write * test(admin): mock getDocFromServer on join re-read path * fix(admin): keep join-preview helpers leaflet-free for emulator * docs(changelog): clarify admin observe framing changeset copy * feat(thermometer): cancel orphan and stuck GPS walks (#109) * feat(thermometer): cancel orphan and stuck GPS walks * fix(thermometer): move identity-heal walk cancel out of annotations * fix(thermometer): avoid Date.now during MapTimerCluster render * fix(thermometer): satisfy react-compiler and unused walk id lint * fix(thermometer): address coderabbit cancel review * test(thermometer): type getDocs mock for identity-heal coverage * feat(leaderboard): board filters, lead pack, and sticky self footer (#110) * feat(leaderboard): board filters, lead pack, and sticky self footer * fix(leaderboard): fix board ready locator and stale self footer * fix(leaderboard): fix self-entry metric type and effect lint * fix(leaderboard): drop unused eslint-disable in self entry * fix(leaderboard): address coderabbit board chrome review * test(leaderboard): update filters visual snapshot for board chrome * test(leaderboard): update filters visual snapshot for board chrome * test(leaderboard): use 390x115 filters screenshot as baseline * feat(ui): desktop content column for entry screens (#111) * feat(ui): add desktop content column for entry screens * fix(ui): scope desktop entry CTA max-width to entry hosts * fix(ui): address coderabbit desktop entry review * fix(ui): restore Feedback desktop flex column parent * fix(ui): address coderabbit desktop entry spacing and tests * test(e2e): refresh tutorial sandbox visual baselines on main (#116) * feat(ui): desktop social column and friends master-detail (#112) * feat(ui): desktop social column and friends master-detail * fix(friends): allow selection clear effect for desktop master-detail * fix(leaderboard): constrain self footer to social column on desktop * feat(map): desktop ops shell with left tool rail (#113) * feat(map): desktop ops shell with left tool rail * fix(map): win rail dock CSS over fixed bottom dock * fix(map): restore walking-cancel props on desktop status rail * feat(map): desktop contextual rail + sheet host (#114) * feat(map): add contextual rail and sheet host for desktop ops * fix(map): gate rail Escape and tool shortcuts * fix(map): split rail panel hook for fast refresh and harden shortcuts * fix(map): drop unused ContextualRailTab import * docs(desktop): add desktop-ops-adapt changeset for wide-screen layout (#115) * chore(release): version 0.9.0 (#117) * chore(release): version 0.9.0 * chore(release): bump package-lock to 0.9.0 * perf(caching): edge Cache-Control + elevation/entitlements/join soft TTL (#118) * perf(worker): set cache-control for assets and geo * perf(geo): persist elevation samples in indexeddb * perf(billing): persist premium entitlements snapshot * perf(session): debounce and cache join code preview * fix(caching): harden entitlements uid check and elevation hydrate order * test(session): assert join preview cache expires at ttl boundary * perf(functions): shared Overpass L2 cache (KV + R2) (#119) * perf(functions): add shared overpass l2 cache via r2 and kv * fix(functions): wire overpass l2 secrets and sigv4 header order * fix(session): Background Sync honesty + Transitland 5m L1 (#120) * fix(session): honor background sync for offline annotations * fix(pwa): restore skip_waiting and sync retry without clients * chore(release): version 0.9.1 (#121) * fix(functions): make overpass l2 secrets optional for deploy (#122) * ci: modernize PR-gated suite and thin main CD (#123) * ci: modernize PR-gated suite and thin main CD * fix(ci): ship thermos remediation for paths-filter and deploy outputs * fix(ci): address coderabbit review for checkout and shell env * chore(ci): soften CodeRabbit App for CLI-primary gate (#143) * chore: purge IDE config path mentions from tracked files * chore: ignore local IDE dir and harden pre-push * chore: drop local IDE dir from tracked gitignore * ci(dependabot): group updates and auto-merge safe npm bumps (#144) * ci(dependabot): group npm patch and minor by dependency type * ci(dependabot): auto-merge npm patch and minor when checks pass * docs: note Dependabot grouping and auto-merge policy * fix(ci): ship thermos remediation for Dependabot auto-merge deploy * fix: address coderabbit cli review for Dependabot config * fix: address coderabbit cli review for automerge head bind * fix(overpass): normalize AbortError to timed-out 504 without Sentry (#155) * fix(overpass): normalize AbortError and retry HTTP 500 with failover logs * test(overpass): cover failover AbortError and retryable statuses * fix(overpass): ship thermos remediation for failover status classify * fix: address coderabbit cli review for overpass failover tests * fix: address coderabbit cli review for overpass body cancel * fix: address coderabbit cli review for async body cancel * fix(overpass): align QL timeout with 25s fetch abort (#157) * feat(admin): annotation filters and sorts on session list (#158) * feat(admin): add annotation count and last-annotation session filters * test(admin): add annotation fields to AdminPanel fixtures * fix(admin): coalesce session list refresh and fix initial loading (#160) * fix(session): canonical end + idle purge orphan code sweep (#159) * fix(session): end idle sessions with outcome and delete codes * fix(session): raise idle purge batch and sweep orphan codes * fix(session): finalize game results on abandoned outcome * fix(session): ship thermos remediation for canonical end race * fix(session): address coderabbit cli review for end/purge * fix(session): delete session codes inside end transaction * feat(session): host leave promote and endSession callables (#161) * feat(session): add leaveHostSession and endSession callables * feat(session): wire host leave promote and endSession callable * fix(session): end alone host leave inside promote transaction * fix(session): fall back to client end when callables unavailable * fix(session): reclaim orphan session codes on create (#162) * fix(session): reclaim orphan session codes on create * fix(session): allow orphan sessionCodes delete in rules * test(session): expect missing code after endRemoteSession delete * chore(release): 0.9.2 host leave transfer notes (#163) * feat(analytics): replace GA with PostHog EU (#166) * chore(deps): add posthog-js * feat(analytics): replace GA with PostHog facade * feat(analytics): PostHog env CSP and privacy copy * feat(analytics): wire session and premium events * chore: add changeset for PostHog analytics * fix(analytics): ship thermos remediation for event layering * fix(analytics): address coderabbit cli review for scrub and host * fix(analytics): disable PostHog GeoIP and external features * fix(test): use vi.stubEnv for PostHog prod init coverage * fix(map): restore iPhone PWA status bar safe-area inset (#169) * perf(a11y): public-shell floors and create weight (#167) * perf(firebase): lazy-init App Check on first token use * fix(a11y): allow pinch zoom in viewport meta * fix(a11y): raise contrast on action and dim tokens * fix(create): request geolocation only on user gesture * perf(create): defer map mount and preconnect basemaps * chore: add changeset for perf a11y shells * ci(lhci): raise public-shell score floors * fix(test): avoid parameter properties in App Check mock * fix(create): ship thermos remediation for map defer ownership * fix(firebase): arm App Check before Functions callables * fix(ci): address coderabbit cli review for lhci and App Check * fix(ci): mock App Check in functions lazy tests and ease LHCI floor * fix(ci): ease mobile LHCI floors after PostHog on main --------- * feat(analytics): PostHog consent banner (#168) * feat(analytics): add consent preference storage * feat(analytics): gate PostHog behind consent * feat(analytics): add production consent banner * chore: add changeset for analytics consent * fix(analytics): ship thermos remediation for consent capture gate * fix(analytics): seed e2e consent and capture pageview on accept * fix(analytics): seed consent denial in first-run e2e --------- * chore(release): 0.9.3 analytics, consent, and a11y notes (#170) * chore(deps-dev): bump the development-dependencies group across 1 directory with 13 updates Bumps the development-dependencies group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@changesets/cli](https://github.com/changesets/changesets) | `2.31.0` | `2.31.1` | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260712.1` | `5.20260724.1` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.0` | | [@sentry/vite-plugin](https://github.com/getsentry/sentry-javascript-bundler-plugins) | `5.3.0` | `5.4.0` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.2` | `4.3.3` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.3` | `6.0.4` | | [eslint](https://github.com/eslint/eslint) | `10.3.0` | `10.8.0` | | [firebase-tools](https://github.com/firebase/firebase-tools) | `15.23.0` | `15.24.0` | | [stylelint](https://github.com/stylelint/stylelint) | `17.14.0` | `17.14.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.59.4` | `8.65.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.1.5` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.110.0` | `4.114.0` | Updates `@changesets/cli` from 2.31.0 to 2.31.1 - [Release notes](https://github.com/changesets/changesets/releases) - [Commits](https://github.com/changesets/changesets/compare/@changesets/cli@2.31.0...@changesets/cli@2.31.1) Updates `@cloudflare/workers-types` from 5.20260712.1 to 5.20260724.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `@playwright/test` from 1.61.1 to 1.62.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.62.0) Updates `@sentry/vite-plugin` from 5.3.0 to 5.4.0 - [Release notes](https://github.com/getsentry/sentry-javascript-bundler-plugins/releases) - [Changelog](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/main/CHANGELOG.md) - [Commits](getsentry/sentry-javascript-bundler-plugins@5.3.0...5.4.0) Updates `@tailwindcss/vite` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-vite) Updates `@vitejs/plugin-react` from 6.0.3 to 6.0.4 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.4/packages/plugin-react) Updates `eslint` from 10.3.0 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.3.0...v10.8.0) Updates `firebase-tools` from 15.23.0 to 15.24.0 - [Release notes](https://github.com/firebase/firebase-tools/releases) - [Changelog](https://github.com/firebase/firebase-tools/blob/main/CHANGELOG.md) - [Commits](firebase/firebase-tools@v15.23.0...v15.24.0) Updates `stylelint` from 17.14.0 to 17.14.1 - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](stylelint/stylelint@17.14.0...17.14.1) Updates `tailwindcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) Updates `typescript-eslint` from 8.59.4 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) Updates `vite` from 8.0.16 to 8.1.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite) Updates `wrangler` from 4.110.0 to 4.114.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.114.0/packages/wrangler) --- updated-dependencies: - dependency-name: "@changesets/cli" dependency-version: 2.31.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@cloudflare/workers-types" dependency-version: 5.20260724.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@playwright/test" dependency-version: 1.62.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@sentry/vite-plugin" dependency-version: 5.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: firebase-tools dependency-version: 15.24.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: stylelint dependency-version: 17.14.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: vite dependency-version: 8.1.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: wrangler dependency-version: 4.114.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * chore(ci): reject Cursor attribution trailers in commit-msg (#171) * chore(ci): harden commit-msg hook before commitlint --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Tomer Gelbhart <gelbharttomer@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
init/page/track+ property scrub)VITE_POSTHOG_*)Test plan
npm test -- src/services/core/analytics.test.ts src/config/env.test.tsnpm run typecheckVITE_POSTHOG_KEYin Doppler prd and confirm live capture (no session codes)Summary by CodeRabbit
New Features
Bug Fixes